Think about all the folks who use the same password for all their logins, plus the hackers have most of their details. Let's say they start skimming banks, Paypal and all the other online opportunities. Who's liable?